Meraki

PhilipDAth

You could create a VLAN port on the MX and Fortinet, plug the dark fibre into those LAN ports, and simply use static routes to move the traffic between the two sites. No VPN required.

PhilipDAth

Very nice!

PhilipDAth

Amazing job. It looks great.

PhilipDAth

You can use this sizing guide to compare the MX100 and the MX95. https://documentation.meraki.com/MX/MX_Sizing_Information/MX_Sizing_Principles

PhilipDAth

I think 192.168.50.0/24 is safe. I have never seen a home router configured to use this range.

PhilipDAth

You'll need to undergo training to gain this knowledge. You may want to start with the Learning Hub. https://community.meraki.com/t5/Learning-Hub/ct-p/hub

PhilipDAth

Did you upgrade via the Meraki Dashboard, or manually via SSH? Are these fully Meraki managed, or in "Hybrid" mode (used to be called "Meraki Monitoring")?

PhilipDAth

>Do we have a way to have different Enterprise Apps configured for different Meraki tenants? The accepted solution is the correct answer. You should only have a single Enterprise App, and then put the certificate thumbprint into each Meraki Dashboard that you want to use that Enterprise App.

PhilipDAth

I would make SW3 the spanning tree root.

PhilipDAth

If only we could live in a perfect world. 🙂 I understand.

PhilipDAth

This llink will have all the answers.

PhilipDAth

What appears in the switch event logs when this happens? What appears in the RADIUS logs when this happens?

PhilipDAth

>You could also rehome the vlans to your firewall When the data flows are not high - this is my preferred approach. I like to do all my firewalling and access restrictions in one place. Switch ACLs can also be applied per-vlan - so you could consider moving these devices into their own VLAN. You can also simply specify the devices address in the source and destination field. If you have an MS Advanced licence, and a suitable switch, you could also consider using Adaptive Policy. You can apply a policy to a specify port this way, using an Adaptive Policy "tag". https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Adaptive_Policy_Overview

PhilipDAth

I would fundamentally change your design. I would not plug two switches into an MX. Choose one switch to be the core, make it the spanning tree root, and then plug all other switches into it.

PhilipDAth

And also: https://status.meraki.net/

PhilipDAth

This guide covers moving a device between networks. https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Moving_Devices_between_Networks

PhilipDAth

I love your work.

PhilipDAth

We really need Port-Channel support in the MX .... just saying.

PhilipDAth

Good attempt, but neither of those help.

PhilipDAth

I'm trying to follow this guide to try out Access Manager using username+password authentication. https://documentation.meraki.com/Access_Manager/Access_Manager_Configuration_Guides/Access_Manager_Username%2F%2FPassword_Authentication_-_EAP-TTLS%2F%2FPAP_with_Entra_ID_Lookup The issue is on the Entra ID side. I configured an exclusion in every conditional access policy for the app (yucky, but ok). So 100%, there is no policy requiring MFA. Our authentication methods policy has been fully migrated to use modern policies. Despite having every conditional access disabled through exclusion, Entra ID is saying the authentication failed because MFA is required. Everyone has to do the above migration - there is no choice. So does this mean the entire section on using username/password authentication against Entra ID in the new Access Manager is a non-starter? Anyone who has it working at the moment will have it fail when their tennancy is forced migrated?

PhilipDAth

MX does not support port-channels. You can't use them.

PhilipDAth

You know you can do this with an ordinary Windows Server without buying anything extra? You install the Windows NPS component. https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise

PhilipDAth

Done. Love the memes. You may have missed your true calling.

PhilipDAth

If you are using PSK authentication or one of Meraki's cloud-based authentication options and they only need Internet access, then it is very simple. This will do exactly what you need.

PhilipDAth

That is suspicious timing. Do you have access to an AWS environment where you could test if it is working or not?

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges